CVE-2022-29221highCWE-94

CVE-2022-29221: falha de alta gravidade em smarty-php smarty

PHP Code Injection by malicious block or filename in Smarty

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar smarty+ Monitorar smarty3

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 4.9%
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
smarty-php · smarty
CVEs relacionadas — smarty-php smarty

No mesmo produto, das mais perigosas para as menos.

CVE-2021-21408HIGHAccess to restricted PHP code by dynamic static class access in smartyEPSS 2.1%CVE-2021-29454HIGHSandbox Escape by math function in smartyEPSS 1.9%CVE-2023-28447HIGHCross site scripting vulnerability in Javascript escaping in smarty/smartyEPSS 1.0%CVE-2026-82531CRITICALSmarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance CacheEPSS 0.8%CVE-2026-62993MEDIUMSmarty: SSRF via redirect bypass of trusted_uri using {fetch}EPSS 0.6%CVE-2026-62992MEDIUMSmarty: Symlink path traversal out of trusted directoriesEPSS 0.5%